[mosquitto-dev] library clientid not random enough

[Stefan May <stefan.may@xxxxxxx>]

Hi,

I found some log messages at the mosquitto broker regarding 
dis-/reconnects that were caused by clients using the same clientid. I'm 
using the automatic generation of clientids in the call mosquitto_new().

So what exactly happens is the following: two clients starting 
*simultaneously* on different computers. Sometimes they get the same 
clientid.

Digging into the library code I was searching for the seeding of PRNG 
and found it in mosquitto_lib_init(). The PRNG is only seeded with the 
current time, which can be equal on different computers. In my opinion 
it should be seeded not only with time, but with some better randomness, 
so that collisions between different clients are reduced. Is using time 
and getpid() a better candidate? Using /dev/random seems like breaking a 
fly on the wheel.

tty, Stefan.
--
Stefan May
Department MPS

Deutsches Elektronen-Synchrotron DESY
A Research Centre of the Helmholtz Association
Notkestr. 85, 22607 Hamburg

Phone: +49-40-8998-4636
for guests: Bldg. 30/Rm. 419